Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...

CVE-2026-48501

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

DEBIAN-CVE-2026-48501

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

EUVD-2026-33340

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

The vulnerability of the config.xml configuration file of the Notepad++ text editor allows a hacker to execute arbitrary code.

The vulnerability of the config.xml configuration file of the text editor Notepad++ is related to the lack of measures taken to eliminate special elements during the processing of the commandLineInterpreter parameter. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

GHSA-XX3C-QF5G-HC39 Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Description Symfony Mailer selects a transport via the MAILERDSN environment variable / configuration e.g. smtp://..., sendmail://..., native://default. SendmailTransport invokes the local sendmail binary and supports two modes: -bs speak SMTP over stdin: the default and -t read the message on...

CVE-2026-44972 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...

CVE-2026-39828 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, cilium, mattermost, kubernetes-dashboard, fscrypt, trivy-operator, kubernetes, kubescape, rancher-agent, istio, flux-image-automation-controller, rancher, flux-source-controller, prometheus, gitea, kaf, telegraf, kyverno, zarf,...

CVE-2026-39834 vulnerabilities

Vulnerabilities for packages: mattermost, crossplane-provider-aws-kinesis, step, melange, flux-image-automation-controller, rancher, splunk-otel-collector, docker, podman, helm, prometheus-operator, flux-notification-controller, pulumi-kubernetes-operator, opentofu, crossplane-provider-aws-eks,...

CVE-2026-46598 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, cilium, mattermost, kubernetes-dashboard, fscrypt, kubernetes, rancher-agent, istio, rancher, prometheus, kaf, buildah, podman, telegraf, kyverno, falco-no-driver, helm, prometheus-operator, zot, opentofu, cloud-provider-aws,...

CVE-2026-46595 vulnerabilities

Vulnerabilities for packages: calico-fips, argo-workflows-fips, traefik, gitea-fips, cloudbeat, harbor-fips, kubernetes, kine, trivy-operator, coder-fips, kube-state-metrics, traefik-fips, zarf-fips, chisel-fips, kubevela-fips, minio-fips, commercial-expanso-edge, seaweedfs-rocksdb,...

CVE-2026-39832 vulnerabilities

Vulnerabilities for packages: calico-fips, gomplate-fips, argo-workflows-fips, gomplate, traefik, pulumi-language-java, gitea-fips, consul, dagger, cloudbeat, pulumi-language-yaml, docker-machine-driver-harvester, harbor-fips, kubernetes, terraform-fips, kine, trivy-operator, kube-state-metrics,...

USN-8321-1: Papers vulnerability

It was discovered that Papers incorrectly handled PDF /GoToR actions. If a user were tricked into opening a specially crafted PDF file, an attacker could use this issue to manipulate command lines and possibly execute arbitrary code...

[SECURITY] Fedora 43 Update: rust-sequoia-sq-1.3.1-11.fc43

Command-line frontends for Sequoia...

[SECURITY] Fedora 43 Update: curl-8.15.0-7.fc43

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 42 Update: rust-sequoia-sq-1.3.1-11.fc42

Command-line frontends for Sequoia...

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtiofsextraargs pod annotation. By injecting -o source=/ along with --no-announce-submounts a...

GHSA-VV9J-GJW2-J8WP yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Impact yeoman-environment versions = 2.9.0 and 6.0.1 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation...

MAL-2026-4783 Malicious code in @iola_adm/iola-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e28a7ca88c4000d6efee1c0e324c8f28bebf03ef988e2ac3aa437857f34ee08 src/cli.js contains a hardcoded endpoint https://apiiola.yasg.ru referenced multiple times lines 1, 2, 198 and invoked via fetch at line 256, in code...